CVE-2020-1952

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue was found in Apache IoTDB .9.0 to 0.9.1 and 0.8.0 to 0.8.2. When starting IoTDB, the JMX port 31999 is exposed with no certification.Then, clients could execute code remotely.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-295

Affected software

Vendor	Product	Versions
Apache	IoTDB	0.9.0 to 0.9.1; 0.8.0 to 0.8.2

References

Timeline

Published: Apr 27, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-195279.8iCMS 7.0.14 attackers to execute arbitrary OS commands via shell metacharacters in the DB_NAME parameter to install/install.php.CVE-2020-195310.0Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes if the YAML CVE-2020-19545.3Apache CXF has the ability to integrate with JMX by registering an InstrumentationManager extension with the CXF bus. If the ‘createMBServer CVE-2020-195476.5Directory Traversal vulnerability exists in PopojiCMS 2.0.1 via the id parameter in admin.php.CVE-2020-19559.8CouchDB version 3.0.0 shipped with a new configuration setting that governs access control to the entire database server called `require_val CVE-2020-195518.8Blacklist bypass issue exists in WUZHI CMS up to and including 4.1.0 in common.func.php, which when uploaded can cause remote code execution CVE-2020-195535.4Cross Site Scripting (XSS) vlnerability exists in WUZHI CMS up to and including 4.1.0 in the config function in coreframe/app/attachment/lib CVE-2020-195546.1Cross Site Scripting (XSS) vulnerability exists in ManageEngine OPManager <=12.5.174 when the API key contains an XML-based XSS payload.CVE-2020-195599.8An issue in Diebold Aglis XFS for Opteva v.4.1.61.1 allows a remote attacker to execute arbitrary code via a crafted payload to the ResolveM CVE-2020-19568.8Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a CVE-2020-19579.8Apache Shiro before 1.5.2, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication CVE-2020-19586.5When LDAP authentication is enabled in Apache Druid 0.17.0, callers of Druid APIs with a valid set of LDAP credentials can bypass the creden